docs(aws): add missing supported DNS record types in Route53 ABAC (#5839)

* fix(aws): warn on TXT AccessDenied due to ABAC

ExternalDNS writes TXT ownership records. ABAC missing TXT can cause 403
AccessDenied from Route 53.

* Update AWS ABAC docs to include TXT in record types
* Log entries when AccessDenied occurs and batch contains TXT
* Added unit tests for AccessDenied detection, TXT detection and logging

Refs: #5773

Signed-off-by: Tobias Harnickell <[email protected]>

* fix(aws): Drop prescriptive IAM warning

* Return the first Route 53 error from `submitChanges` so operators see
  the original AWS message
* Remove IAM-guessing branch while keeping split-and-retry submission
* Tidy error test and fall back to `provider.NewSoftErrorf` when no AWS
  error was captured
* Add tests for error return on failures upon zone submission

Signed-off-by: Tobias Harnickell <[email protected]>

* fix(aws): Remove TXT-specific error handling

Signed-off-by: Tobias Harnickell <[email protected]>

* fix(aws): Remove Route53 final error message

Signed-off-by: Tobias Harnickell <[email protected]>

* fix(aws): Remove unused import of `error`

Signed-off-by: Tobias Harnickell <[email protected]>

---------

Signed-off-by: Tobias Harnickell <[email protected]>

Author: TobyTheHutt

docs/tutorials/aws-sd.md

@@ -74,7 +74,7 @@ Using tags, your `servicediscovery` policy can become:
         "ForAllValues:StringLike": {
           "route53:ChangeResourceRecordSetsNormalizedRecordNames": ["*example.com", "marketing.example.com", "*-beta.example.com"],
           "route53:ChangeResourceRecordSetsActions": ["CREATE", "UPSERT", "DELETE"],
-          "route53:ChangeResourceRecordSetsRecordTypes": ["A", "AAAA", "MX"]
+          "route53:ChangeResourceRecordSetsRecordTypes": ["A", "AAAA", "CNAME", "MX", "TXT"]
         }
       }
     },

docs/tutorials/aws.md

@@ -59,7 +59,7 @@ You can use Attribute-based access control(ABAC) for advanced deployments.
         "ForAllValues:StringLike": {
           "route53:ChangeResourceRecordSetsNormalizedRecordNames": ["*example.com", "marketing.example.com", "*-beta.example.com"],
           "route53:ChangeResourceRecordSetsActions": ["CREATE", "UPSERT", "DELETE"],
-          "route53:ChangeResourceRecordSetsRecordTypes": ["A", "AAAA", "MX"]
+          "route53:ChangeResourceRecordSetsRecordTypes": ["A", "AAAA", "CNAME", "MX", "TXT"]
         }
       }
     },